crtsh-subdomains

v0.1.0Verified publisher

Finds a domain's subdomains in Certificate Transparency logs through crt.sh or Cert Spotter

Community-packaged from github.com/osintverse-community/crtsh-subdomains: the registry's community pins the upstream release; the tool is its authors' work. Maintain that project? Claim this package.

Run

TerminalAgent

Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).

{"tool":"osintverse-community/crtsh-subdomains","target":"otinstaller.com","input_type":"domain"}

Or just say: "Run osintverse-community/crtsh-subdomains on otinstaller.com with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.

ot run osintverse-community/crtsh-subdomains d:otinstaller.com --format table

ot install osintverse-community/crtsh-subdomains

Docker image in a read-only container · talks to crt.sh, api.certspotter.com · no key · up to 5 min. The first ot run installs the tool after asking once. The example value is the registry's own test input, so this command has run. Drop --format table for JSON.

Don't have ot? Install it in one line

macOS / LinuxWindows

curl -fsSL https://get.otinstaller.com/ot | sh

What this script does

Downloads the latest ot release for your machine from GitHub Releases.
Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
Puts ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.

irm https://get.otinstaller.com/ot.ps1 | iex

What this script does

Downloads the latest ot release for your machine from GitHub Releases.
Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
Puts ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.

Evidence

Security tab →

Pinnedimage sha256:5cabece2…1990ab. The same bytes on every install; ot pulls by digest, never by tag.
Signedby https://github.com/osintverse-community/crtsh-subdomains/.github/workflows/otinstaller-release.yml@refs/heads/main via token.actions.githubusercontent.com, verified by the registry on 20 Oct 2026. ot checks the same identity before every install and refuses another signer.
Scanned20 Oct 2026: 0 critical, 44 high, 63 medium, 62 low vulnerabilities; 0 embedded secrets, 0 malware heuristics; SBOM with 89 packages.
Workssmoke test passed on 20 Oct 2026 (exit 0 in 19.9 s, offline sandbox); the nightly health check passed (today).
Backed upa copy of this image is on the registry's mirror. If the original registry refuses it, ot pulls the same digest from the mirror and checks the same signature.
Reviewedosintverse-community is a verified publisher: the registry confirmed who runs it, and a person reviewed its first release against the acceptable-use rules.

What you get back

Result envelope →

{
  "envelope": 1,
  "tool": "osintverse-community/crtsh-subdomains@0.1.0",
  "runtime": "docker",
  "input": {
    "domain": "otinstaller.com"
  },
  "started_at": "2026-10-21T09:00:00Z",
  "duration_ms": 4100,
  "exit_code": 0,
  "entities": [
    {
      "type": "subdomain",
      "value": "mail.example.com"
    }
  ],
  "warnings": []
}

Every tool returns this shape, shaped here from what this tool declares it finds. --format table to read it; ot extract and ot auto to continue.

crtsh-subdomains

Lists every name that appeared in a TLS certificate for a domain or its subdomains, using the public Certificate Transparency search at crt.sh (or Cert Spotter when crt.sh is down), with the first and last certificate dates and the issuers. Passive: the target is never contacted.

ot run osintverse-community/crtsh-subdomains --domain example.com

Inputs

Input	Required
`domain`	yes

Notes

Old names stay in the logs after they stop resolving, so check them with osintverse-community/dns-records. Wildcard names are reported without the *.. crt.sh is a free service that is often slow or down; the tool retries it and then falls back to Cert Spotter's free API, which covers fewer old certificates and is limited to a few lookups an hour without a key.

Next steps

Resolve the names with osintverse-community/dns-records.

Development

pip install # no dependencies
python -m unittest
ot validate

Releases are built, signed and published by the otinstaller release workflow (Actions tab, with the version to release).

License

MIT

Guides using this tool

Domain investigation playbook

DNS, subdomains, certificates, history and look-alikes of a domain, passively first

About domain
intermediate

Verified publisher

What next

crtsh-subdomains finds subdomain. Tools that take those:

subdomain → 9 tools ot auto, with a saved result

Other domain tools

All domain tools →

Alternatives to crtsh-subdomains that also take a domain; ot auto runs every installed one on the same value.